{"id":"CVE-2026-105840","published":"2026-10-06T14:17:41.300","lastModified":"2026-10-09T02:16:55.510","description":"lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving user.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://ohse.de/uwe/software/lrzsz.html","tags":[]},{"url":"https://ohse.de/uwe/software/lrzsz/NEWS-0.13.0.html","tags":[]},{"url":"https://www.vulncheck.com/advisories/lrzsz-before-0.13.0-path-traversal-via-lrz-restricted-mode-checkpath","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The lrzsz library contains a path traversal vulnerability in its receive utility that allows attackers to write files outside the intended directory using absolute paths. This can lead to arbitrary file overwrite and potentially system compromise.","exploitability":"Exploitation requires a malicious ZMODEM sender to initiate a transfer with absolute paths, but is relatively straightforward once the vulnerable lrz utility is in use.","blast_radius":"The vulnerability could affect any system running lrzsz version before 0.13.0 where users can receive ZMODEM transfers, potentially allowing attackers to overwrite critical system files or configuration data.","remediation":"Upgrade to lrzsz version 0.13.0 or later to fix the path traversal vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["file-overwrite","path-traversal","zmodem"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:06:08.658Z"}}